This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Front Range OWASP Conference 2013/Presentations/Headers"

From OWASP
Jump to: navigation, search
(Created page with "===Adventures in Large Scale HTTP Header Abuse=== While the technique of sending malicious data through HTTP Header fields is not new, there is a conspicuous lack of informat...")
 
 
Line 8: Line 8:
  
 
Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities.
 
Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities.
 +
 +
[[Media:Wolff.pptx | Slides]]
 +
[https://vimeo.com/68071431 Video]
 +
<br>

Latest revision as of 17:46, 11 June 2013

Adventures in Large Scale HTTP Header Abuse

While the technique of sending malicious data through HTTP Header fields is not new, there is a conspicuous lack of information on the topic.

This presentation explores research and testing results of random auditing of 1.6 million websites. The speaker will address the history of HTTP Header attacks, the logic that went into the creation of an HTTP Header Audit tool, and the most interestingly the findings of the test run.

How many vulnerable websites were discovered? What attacks were they most susceptible to? Which Header fields are most likely to be vulnerable?

Finally, the presentation will discuss defensive techniques around HTTP header abuse and how to efficiently audit a sites HTTP Header fields for vulnerabilities.

Slides Video